Multiparty quantum secret sharing with pure entangled states and decoy photons* 
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We present a scheme for multiparty quantum secret sharing of a private key with pure entangled 
states and decoy photons. The boss, say Alice uses the decoy photons, which are randomly in 
one of the four nonorthogonal single-photon states, to prevent a potentially dishonest agent from 
eavesdropping freely. This scheme requires the parties of communication to have neither an ideal 
single-photon quantum source nor a maximally entangled one, which makes this scheme more conve- 
nient than others in a practical application. Moreover, it has the advantage of having high intrinsic 
efficiency for qubits and exchanging less classical information in principle. 
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• The principles in quantum mechanics, such as the uncertain relation, the correlation of entangled quantum systems 
and the collapse in quantum measurement, provide some novel ways for secure communication. For instance, quantum 
■ key distribution (QKD), whose goal is used to create a private key between two authorized users, has become one of the 
most mature applications of quantum information techniques [l[ 0, d, 0, [H, 0, 0, HI • The noncloning theorem forbids a 
vicious eavesdropper, say Eve, to eavesdrop the quantum information transmitted through a quantum channel freely. 
jS-j-, The action of Eve will inevitably disturb the quantum systems transmitted and leave a trace in the outcomes obtained 
by the receiver. The two authorized parties can find out Eve's eavesdropping by comparing a subset of the outcomes 
in public. This principle has been also applied to other branches of quantum communication, such as quantum secure 
direct communication [ij, ITol. ITlj. deterministic quantum communication fl2l. Hlj, [Til. flo| . quantum secret report [l(|, 
quantum broadcast communication [l7|, quantum secret conference [llj], quantum dialogue [l9| . and so on. 

Quantum secret sharing (QSS) is the quantum counterpart of the classical secret sharing. In a secret sharing, a 
boss, say Alice, has two agents (Bob and Charlie) who are at a remote place, and she wants to send her instruction to 
her agents for dealing with her business. However Alice suspects that one of her agents may be dishonest, and she does 
not know who is the dishonest one. Alice believes that the honest one can keep the potentially dishonest from doing 
harm to her benefits if they both coexist in the process of the business. For the security of the secret message, say 
Ma, Alice will divide it into two pieces, Mb and Mc, and then sends them to Bob and Charlie, respectively. If and 
only if Bob and Charlie cooperate, they can read out the message Ma = Mb®Mc\ otherwise none can obtain a useful 
information about the secret message. As classical signal is in the eigenvectors of a quantum operator, it can be copied 
freely and fully. That is to say, it is impossible in principle to share a secret message with classical physics. When 
quantum mechanics enters the field of information, the story is changed. In 1999, Hillery, Buzek and Bcrthiaumc 
(HBB99) 20] proposed an original QSS scheme for creating a private key among three parties with a three-particle 
Greenberger-Horne-Zeilinger (GHZ) state \GHZ) — ^=(|000) + 1 11 1) ) , the maximally entangled three-particle state. 
Here |0) and |1) are the two eigenvectors of the measuring basis (MB) Z (for example the z-direction of 1 / 2-sp in) . 
Now, there are a great number of QSS schemes, such as the schemes [2p|. l2ll [22l. [23l. [2^.[25L [26l. [27l [28l [29l. [30l. [3lL [33. [33j 
for creating a private key and those [H, HH, Ha H3] for sharing an unknown quantum state. 

Almost all the existing QSS schemes are based on either maximally entangled quantum signals 0, [U H2, HI, HH, 
25l . I26L [27l . [28[ or an ideal single-photon quantum signal 0, Ha Hi], [32, Hi| , which makes them difficult in a practical 
application. On one hand, a practical ideal single-photon source cannot be obtained with present techniques although 
people can in principle produce a single photon. On the other hand, an entangled source usually generates a pure 
entangled state because of the property of asymmetry in the source. 

In this paper, we will present a scheme for quantum secret sharing with pure entangled states, not maximally entan- 
gled ones. The boss Alice exploits some decoy photons to forbid a potentially dishonest agent to steal the information 
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about the private key obtained by another agent. This scheme has the advantage of having high intrinsic efficiency for 
qubits and exchanging little classical information. Moreover, it does not require the parties of communication to have 
an ideal single-photon quantum source, which is not available in a practical application with the present techniques, 
or a maximally entangled quantum source. Thus this QSS scheme is more convenient than others. 

Now, let us describe the principle of our QSS scheme. For simplicity, we first describe it with two agents, i.e., Bob 
and Charlie, and then generalize it to the case with N agents. For the case with two agents, Alice should first prepare 
a sequence of pure entangled photon pairs S. Each pair is in one of the four states {\(f>} bc, \4>') bc, l^P) bc, W) bc}- 

\<P) bc = (a|00)+/3|ll))fl C , (1) 

BC = (a|ll)+/3|0Q))flc, (2) 

\1>)bc = (a|01) + /3|10))fl O , (3) 

W)bc = (a|10)+/3|01)) sc , (4) 

where 

\a\ 2 + \P\ 2 = l. (5) 

Suppose that Alice's entangled source produces an entangled pair in the state \4>)bc = (a|00) + P\11})bc m each 
signal interval, Alice can obtain the entangled pair sequence S by operating some of the pairs with the two unitary 
operations U = |0) (0| + |1) (1| and U x = |1) (0| + |0) i.e., 

W)bc = (U? ®U?)\<t>) B c, (6) 
mBC = K®uC)\<t>) B c, (7) 
W)bc = {U? ®U°)\4>)bc- (8) 

Alice divides the sequence S into two sequences Sb and Sc- The sequence Sb is made up of all the B photons of 
the photon pairs in the sequence S. All the C photons compose of the partner particle sequence Sc, similar to Refs. 
0, 0, OH El, Ell 03 ■ Different from the Karlsson-Koashi-Imoto (KKI) QSS scheme [2l| . the quantum information 
carries in this scheme are a sequence of pure entangled stats. The photon B and the photon C in a pure entangled state 
are completely correlated when they are measured with the MB Z, but not with the MB X = {\±x) = 4g(|0) ± |1))}. 
For instance, 

|0) bc = (a|00> + j3|11»bc7 = + /?)(| + x>| + a:> + | - x>| - a:)) 

+ (a-0){\+x)\-x)+\-x)\+x))]. (9) 

That is, on one hand, the security of the quantum secret sharing with pure entangled states is lower than that with Bell 
states if the parties use the two MBs Z and X to measure their photon pairs for the eavesdropping check directly [l^] • 
On the other hand, the quantum source is more convenient than maximally entangled states [12J as the asymmetry 
in a practical quantum source makes the photon pairs in a pure entangled state, not a maximally one. 

For ensuring the security of the transmission of the photon sequences Sb and Sc, Alice should add some decoy 
photons in these two sequences before she sends Sb and Sc to Bob and Charlie, respectively. The decoy photon 
technique was proposed first by Li et al. [38l . |39| in QKD network, and now it has been applied to other branches of 
quantum communication, such as deterministic secure quantum communication [l2j], quantum secret report [Til ] and 
quantum secret conference fl8| . The principle of the decoy photon technique is that Alice prepares some photons which 
are randomly in one of the four nonorthogonal states {|0), |1), | + x), \ — x)} and then inserts them into the sequences 
Sb and Sc- As the states and the positions of the decoy photons are unknown for all the parties of the communication 
except for Alice herself, the eavesdropping done by an eavesdropper will inevitably disturb these decoy photons and 
will be detected, similar to Bennett-Brassard 1984 (BB84) protocol [|J and its modified version Q. The number of the 
decoy photons is not required to be very large, just large enough for checking eavesdropping. Still, it is unnecessary 
for Alice to prepare her decoy photons with an ideal single-photon source. She can get them by measuring the photon 
B in a pure entangled state \4>)bc and manipulating the other photon C with some unitary operations. For example, 
if Alice wants to make her decoy photon in the state | + x), she measures the photon B in the pure entangled state 
\4>)bc with the MB Z and then performs a Hadamard (H) operation on the photon C when she obtains the outcome 
\0) B , otherwise she performs the operation H®U X on the photon C. Here H = (l/v^K|0)(0| + |1)(0| + |0)(1| - |1)(1|). 
As the analysis of the decoy photons is as same as that in the BB84 QKD protocol [2j, our QSS scheme is secure if 
Alice exploits her decoy photons to forbid the potentially dishonest agent to eavesdrop freely. 

Suppose that Alice codes the states {\4>)bc, W)}bc as and codes the states {\4>)bc, W)bc} as 1. Our three-party 
QSS scheme with pure entangled states can work with following steps. 
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(51) Alice prepares a sequence of pure entangled two-photon states S, N ordered photon pairs. Each photon pair 
BC is randomly in one of the four states {\4>)bCi \4>')bCi IV^BC; IV'Obc}- She divides the sequence S into two partner 
particle sequences Sb and Sc- The sequence Sb (Sc) is made up of the photons B (C) in the ordered N photon pairs. 
Alice prepares 2k (k << N) decoy photons by measuring the photons B in some photon pairs BC and operating 
the remaining photons C with the two unitary operations Ui (i — 0, 1) and the H operation. She inserts randomly k 
decoy photons into the sequence Sb and the other k decoy photons into the sequence Sc- 

(52) Alice sends the sequence Sb and Sc to Bob and Charlie, respectively. 

(53) Bob and Charlie measure their photons in the sequences Sb and Sc independently with the two MBs Z and 

X. 

If Bob and Charlie have the capability of storing their quantum states, they can measure their photons in the 
sequences Sb and Sc in the same way as those in Refs. [tl[l(|. That is, Alice first tells Bob and Charlie which are the 
decoy photons and their states, and then Bob and Charlie measure the decoy photons with the same MBs as those 
used by Alice for preparing them. For the other photons, Bob and Charlie both choose the MB Z to measure them. 
In this way, all the decoy photons can be used for checking eavesdropping. The k decoy photons in the sequence Sb 
(Sc) can be used to check the security of Alice-Bob (Alice-Charlie) quantum line in the same way as the BB84 QKD 
protocol 0] which has been proven to be secure for generating a private key [40l | . 

Without quantum memory, Bob (Charlie) can measure the photons in the sequence Sb (Sc) i n the same way as 
that used in the modified BB84 QKD protocol @. That is to say, Bob (Charlie) measures his photons by using the 
MB X with the probability p (p << 1/2 if N is large enough) and the MB Z with the probability 1 — p. In this way, 
half the decoy photons measured by Bob (Charlie) in the sequence Sb (Sc) are useful for checking eavesdropping as 
the MBs for preparing and measuring them are the same ones. In this time, Alice and Bob (Alice and Charlie) can 
analyze the error rate of the decoy photons in the sequence Sb (Sc) with the refined analysis technique discussed in 
the modified BB84 QKD protocol [8j. In detail, they divide the useful decoy photons into two groups, the one they 
both choose the MB Z and the other one they both choose the MB X. They analyze the error rates of these two 
groups independently. When the error rates of the two groups of decoy photons both are lower than the threshold r)t , 
Alice believes that the transmission between her and her agents is secure or the information leaked to a potentially 
dishonest agent is negligible. 

(54) If Alice confirms that the two quantum lines, i.e., Alice-Bob and Alice-Charlie, both are secure, Alice and her 
agents distill a private key Ka = Kb © Kc with the other outcomes they all choose the MB Z, similar to QKD 
otherwise they repeat their QSS from the beginning. Here Ka, Kb and Kc are the key obtained by Alice, Bob and 
Charlie, respectively. 

As pointed out in Ref. [2l|, a QSS scheme is secure if it can prevent the potentially dishonest agent from eaves- 
dropping freely. In this QSS scheme, Alice exploits her decoy photons to forbid her agents to eavesdrop freely. As 
the states and the positions of the decoy photons are unknown for Bob and Charlie, either Bob or Charlie will be 
detected if he wants to steal the information about the key obtained by the other agent. Thus this QSS scheme can 
be made to be secure. On the other hand, as the agents choose the MB Z with a lager probability 1 — p to measure 
their photons used for creating the private key, the intrinsic efficiency of qubits r\ q = ^ is far larger than that in KKI 
QSS scheme [2l| as p is much smaller than 1/2. Here q u is the number of the useful qubits and qt is that of the total 
qubits transmitted. 

It is straightforward to generalize this scheme to the case with M agents, say Bobi (i — 1,2, ■ ■ ■ , M). Similar to the 
case with two agents, Alice prepares a sequence of pure entangled M-photon quantum systems S' (ordered N pure 
entangled quantum systems), and each quantum system is randomly in one of the four states {|$), |$'), \ ^), I*')}- 
Here 
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(11) 

(12) 
(13) 

Alice divides the sequence S' into M partner photon sequences S' Bi , S' B2 , and S' B . The sequence of S[ (i = 
1, 2, • • • , M) is made up of the photons Bi in all the ordered quantum systems. Also Alice insets randomly k decoy 
photons, which are prepared by measuring a photon in a pure entangled state and operating the remaining photons 
with unitary operations Uq, U± and H, into each partner photon sequence Si before she sends it to the agent Bob^. 
If all the agents have the capability of storing their quantum states, Alice first tells the agents which are the decoy 
photons and their states in the partner photon sequences when all the agents have received their sequences, and then 
the agents measure the decoy photons with the same MBs as those used by Alice for preparing them and measure all 
the pure entangled states with the MB Z . Without quantum memory, the agents should measure their photons in 
the same way as the case with two agents. That is, all the agents measure their photons by using the MB X with a 
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small probability p and the MB Z with the probability I — p. In this time, the rate of the useful qubits to all those 
transmitted is p u = (1 — p) M . As the same as the case with two agents, the security of each of the partner photons Si 
is ensured by the decoy photons, the same as the BB84 QKD protocol @ or its modified version [g. In other words, 
this QSS scheme with TV agents can be made to be secure. 

As proven by Deng et al. [4l| that the one-way QSS schemes based on entanglement and a collective eavesdropping 
check, such as the two famous QSS schemes, the HBB99 QSS scheme and the KKI QSS scheme, are insecure with a lossy 
quantum channel if the parties only exploit the correlation of the entangled quantum systems to check eavesdropping, 
this QSS scheme is an optimal one. It has the following advantages obviously: (a) The quantum signals are a sequence 
of pure entangled states, not maximally entangled ones, which makes it more convenient than others in a practical 
application, (b) The boss Alice exploits some decoy photons to ensure the security of this scheme, which is just 
the requirement of a secure one-way QSS scheme based on entanglement and a collective eavesdropping check in a 
practical application [4l| . (c) It requires the boss has neither an ideal single-photon quantum signal source nor a 
maximally entangled source, (d) It does not requires the parties exchange a large number of classical information as 
the agents choose a large probability to measure their photons with the MB Z. (e) Its intrinsic efficiency for qubits 
is very high, approaching 100% when the number of bits in the private key Ka is large enough. 

In conclusion, we have presented a QSS scheme with pure entangled states and decoy photons. As this scheme 
requires the parties to have neither an ideal single-photon quantum source nor a maximally entangle one, it is more 
convenient in a practical application than others. Whether the agents have quantum memory or not, this scheme 
has the advantage of having a high intrinsic efficiency for qubits and exchanging little classical information. For a 
one-way QSS based on entanglement and a collective eavesdropping check, it is useful for the boss Alice to make at 
least the qubits used for checking eavesdropping in single-particle states, not entangled ones [4l|. Thus this scheme 
with decoy photons is an optimal one. 

This work is supported by the National Natural Science Foundation of China under Grant Nos. 10604008 and 
10435020, and Beijing Education Committee under Grant No. XK100270454. 
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